systemd doesn't fill that file anymore. And denyhosts uses the log file to put the attacking servers into /etc/hosts.deny. The systemd logs are binary trash in /var/log/journal/$strangeID/system.journal.

Is there a chance to get systemd and denyhosts working together? How do the other distributions handle that?